Groundwork for securing the web front end (vrek gol-wqf95dq). The app
does not enforce login yet.
- src/lib/admin-file.ts: the admin file at ADMIN_AUTH_FILE (default
.data/admin.json). scrypt hashing (N=2^16, random salt, bounded
parameters, constant-time compare), zod-validated reads where a
malformed file is an error, and atomic 0600 writes that won't
replace an existing admin without overwrite. Plain Node, so the
CLI can share it (iss-mffqscg).
- src/lib/admin-auth.ts: server-only app layer; failed logins always
cost one hash.
- scripts/create-admin.mts + `npm run admin:create`: create or reset
the admin outside the app, interactive (hidden, confirmed) or piped
(iss-7xmka20). The README documents it, a no-npm Node one-liner,
the file format, and password reset.
- src/lib/session-token.ts and session.ts: stateless HMAC-signed
session cookie, keyed from the password hash so a password change
ends every session, with a 12 h sliding window (iss-e27nb70,
dec-f0xar8r).
281 tests, 99.8% line coverage. Refreshes the vrek export.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
